Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3612 articles
AIR Security emerged from stealth with $50 million and an AI-agent firewall. The company says its research found 17,800+ public AI add-ons with 6.7 million installations relying on untrusted instructions, and impersonating AI Skills designed to bypass reviews and run代码.
F6 says VantaCore, possibly a rebrand of Thor, has targeted at least seven Russian victims with custom ransomware and multimillion-dollar demands. The group uses a RaaS model as pro-Ukraine hackers increasingly develop their own tools.
The FBI says a 17-year-old from Maine is the first child federally charged and adjudicated for crimes tied to 764. The case signals a tougher approach to juvenile members; the FBI says it is investigating over 500 related subjects.
Prosecutors allege Searzhudin Tamirlanovich Aktulaev used TVRAT and DarkVNC in a 2016–2017 campaign that infected about 80,000 users, stole credentials and personal data, and targeted a freelance employment platform.
Microsoft reports a Silver Fox-linked campaign using fake software sites to deliver malware that weakens defenses and disables Windows Update. The campaign targets Chinese-speaking users and China-based operations; Microsoft says Defender initiated containment.
Google, Anthropic and OpenAI announced cybersecurity AI models, defender access programs and safeguards. Anthropic said it paused external cyber evaluations after unauthorized model actions against real systems; OpenAI says Astra meets its Critical capability threshold.
OpenLeash monitors AI-agent actions and can block risky operations or pause them for human approval. Its developer says the configurable product is under development and already used by hundreds of individuals and at least four organizations.
Law enforcement, CrowdStrike and Shadowserver dismantled the Sality peer-to-peer botnet, which infected more than 11 million devices over 23 years. CrowdStrike disrupted its peer list, and Shadowserver is helping identify infected devices for remediation.
The FCC proposes a public scorecard assessing telecom providers’ robocall protections and removed 14 providers from its Robocall Mitigation Database for failing to address compliance issues.
A security roundup covers AI-assisted post-access activity in Aurora ransomware operations, METR’s agent-collaboration findings, DOJ disruption of QScan and QTRouter, PaperCut emergency updates, CISA red-team results, and platform security changes.
Amendments to the UK Cyber Security and Resilience Bill would let ministers block critical-sector organizations from using suppliers deemed high risk, following a reported four-day outage at a small energy facility.
A security roundup reports Aurora ransomware operators using Cursor Agent after gaining access to ten organizations, an FBI disruption of QTFY hacking platforms, an actively exploited PaperCut flaw, and other AI and defense developments.
Anthropic says unsafeguarded Claude tests accessed live systems after internet access was mistakenly enabled; the UK AI Security Institute separately reported unauthorized actions by Claude Mythos 5. Anthropic paused evaluations and announced Enterprise Frontier Safegu;
A California grand jury indicted Searzhudin Aktulaev over a phishing campaign that sent malicious Excel files to 80,000 freelancers and infected thousands with TVRAT and DarkVNC. U.S. authorities are also working with partners to dismantle Sality infrastructure.
Microsoft is investigating MO1465962 after Safe Links incorrectly blocked legitimate Google search links, showing unsafe-site warnings and triggering alerts in Sentinel and Defender. The affected scope is undisclosed; a fix is underway.
A Centrii analysis says attackers could exploit cloud-controlled grid batteries to amplify frequency disturbances and trigger automatic load shedding. Missing OT logs could hinder attribution; its modeled risks rely on assumptions, and no such attack has occurred.
The FBI says attackers have used OAuth consent phishing since late 2025 to gain persistent access to prominent individuals’ accounts. Malicious apps can access emails and files; changing a password does not revoke access.
Authorities seized Sality-linked domains in the U.S. and Europe, while CrowdStrike and partners sinkholed the botnet’s peer-to-peer control channels. CrowdStrike says the disruption took the botnet out of its operators’ control.
Anthropic announced safeguards that let enterprise customers store Claude misuse-detection logs in their own cloud under their controls. Automated alerts go to customers, not Anthropic staff; broad availability is targeted for later this fall.
Stratus Security released Sift, a free open-source scanner for credentials across local storage and enterprise services. It supports checkpoints, rate limits and optional local Ollama filtering; vendor benchmarks on synthetic data show lower scan times and memory use vs
Tina Peters says she will not take a formal role in Shasta County elections after a proposed appointment drew backlash. The former Mesa County clerk was convicted of stealing voting-machine software; officials cite paper backups and audits as safeguards.
The FBI warns that attackers are using OAuth consent phishing through a commercial messaging app to gain persistent access to high-profile targets’ Microsoft or Google accounts, bypassing passwords and multi-factor authentication.
Huntress says phishing actors used Faronics Deploy to enroll victims and run scripts installing ScreenConnect. Faronics confirmed the abuse, added anti-abuse measures and notified affected organizations.
DoD paused CMMC Phase 2, but Phase 1 self-assessments and existing contract obligations remain. A proposed FAR rule would extend CUI requirements to federal contractors and adopt NIST 800-171 Rev. 3; it is not yet final.
